CVE-2022-45934

What it actually does

Integer wraparound in l2cap_config_req allows memory corruption when processing crafted L2CAP_CONF_REQ packets over the Bluetooth stack.

Why it matters to the business

Local attackers can trigger crashes or gain elevated privileges on affected Linux systems that use Bluetooth, potentially leading to data theft or service disruption across servers, desktops, and embedded devices.

How an attack unfolds

An attacker with local access crafts malicious L2CAP configuration request packets that trigger an integer wraparound during size calculations, resulting in out-of-bounds memory access that can be leveraged for code execution or denial of service.

How to fix it

Upgrade the Linux kernel to a version that resolves the integer wraparound in net/bluetooth/l2cap_core.c; apply vendor patches for Fedora, Debian, and NetApp products as they become available; disable Bluetooth when not required.

How to confirm the fix worked

Verify kernel version is newer than 6.0.10 and contains the fix for l2cap_config_req; test Bluetooth stack with fuzzing tools targeting L2CAP configuration requests; confirm no wraparound occurs in packet length handling.

Typical attack path

1. Obtain local user access on a vulnerable Linux system with Bluetooth enabled
2. Send specially crafted L2CAP_CONF_REQ packets via the Bluetooth socket interface
3. Trigger integer wraparound in l2cap_config_req leading to memory corruption
4. Exploit the resulting corruption for privilege escalation or system crash

How to detect it

Review kernel logs for Bluetooth L2CAP errors or crashes around the time of suspicious local activity; inspect process activity involving bluetooth or l2cap sockets; correlate with user sessions that have local access.

What your security team should do

• Prioritize kernel updates on all Linux systems exposing Bluetooth interfaces
• Monitor for new fixed versions from distributions and hardware vendors
• Restrict local Bluetooth access via policy where feasible
• Include Bluetooth-related kernel modules in vulnerability scanning routines